Auth/Sessions: Unable to set cookie in development

[dthyresson]

I followed the sessions starter and was able to setup sessions, the store and DO bingings.

I could tell in my local wrangler that the DO were being saved/stored on login.

However, the request didn't have the cookie set so I was never properly logged in when in development.

After some digging, I found that if I patched createSessionCookie so the cookie was not Secure (ie, needed https), then cookies were properly set, loaded from the request and auth behaved as expected.

export const createSessionCookie = ({
  sessionId,
  maxAge,
}: {
  sessionId: string;
  maxAge?: number | true;
}) => {
  const isViteDev =
    typeof import.meta.env !== "undefined" && import.meta.env.DEV;

  return `session_id=${sessionId}; Path=/; HttpOnly; ${isViteDev ? "" : "Secure; "}SameSite=Lax${
    maxAge != null
      ? `; Max-Age=${maxAge === true ? MAX_SESSION_DURATION / 1000 : maxAge}`
      : ""
  }`;
};

Perhaps something like this could work or maybe better yet some way of defining cookie props in setupSessionStore(env)?

[justinvdm]

Thanks @dthyresson! I'm not sure why we haven't run into this for our own local development, but needing to not have Secure in dev does make sense.

I'll make a PR with both changes (no Secure in dev + flexibility to define cookie for store)

[dthyresson]

Thanks @dthyresson! I'm not sure why we haven't run into this for our own local development, but needing to not have Secure in dev does make sense.

I'll make a PR with both changes (no Secure in dev + flexibility to define cookie for store)

Thanks!

I forgot to note that I use Safari and perhaps they have more restrictive rules? Though I believe I tried Chrome as well.

[justinvdm]

@dthyresson done! Will release shortly. We'll still need to document this, but for now here's an example of how to define how to create cookies:

const sessions = defineDurableSession({
  // ...
  cookieName: "user_session",
  createCookie: ({ name, sessionId, maxAge }) => `${name}=${sessionId}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge ?? (7 * 24 * 60 * 60)}`
});

[justinvdm]

Released in 0.0.7!